This vulnerability (CVE-2026-42893) involves improper neutralization of special elements used in commands (CWE-77) in Microsoft Outlook for iOS, specifically within the M365 Copilot feature. It enables an attacker without privileges to tamper with the system remotely via network access. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, no availability impact, and an official fix has been released by Microsoft. The affected version explicitly identified is 1.0.0.

An attacker can remotely perform tampering actions due to command injection, potentially altering data or behavior within the affected application. There is no direct confidentiality or availability impact reported. The integrity impact is high, meaning the attacker can modify or manipulate data or commands within the application context.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as soon as possible to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42893 for detailed patch information and deployment instructions.